lucascruz676[.]github[.]io

PhishDestroy has opened an active investigation into lucascruz676.github.io, a GitHub-hosted site that is being used for credential harvesting campaigns. This fraudulent page mimics a legitimate login portal to trick visitors into surrendering usernames, passwords, or other sensitive data. The domain resolves to the IP address 185.199.108.153 and is currently served over an HTTPS connection secured by a Let’s Encrypt certificate, which helps it appear trustworthy at first glance. This domain was flagged after VirusTotal scans returned 0 detections out of 95 engines, indicating that most antivirus and security tools have not yet added it to their detection lists. The page was registered through GitHub, Inc., leveraging the platform’s free hosting to rapidly deploy and rotate phishing infrastructure. Although the exact creation date is not visible in public records, the absence of detections suggests it is a recently activated threat. If you have visited lucascruz676.github.io, avoid entering any login credentials or personal information. Clear your browser cache and cookies for the site, then run a full antivirus scan. Consider changing passwords for any accounts that may have been exposed and enable multi-factor authentication where available. Report the domain to your security team or to PhishDestroy to help block future access.